feat(OXICLOUD_DIRECT_PUT_MAX_BYTES): add a security limit on direct PUT

ensure files does not exeed OXICLOUD_MAX_UPLOAD_SIZE, prefer to deny from header rather consuming bandwidth
    add OXICLOUD_DIRECT_PUT_MAX_BYTES for direct PUT (non chunked), admins can fine tune their prefered values

example.env

@@ -31,18 +31,48 @@ OXICLOUD_SERVER_HOST=127.0.0.1
 # Example: https://cloud.example.com
 #OXICLOUD_BASE_URL=https://cloud.example.com
 
-# Maximum upload size in bytes (default: 10 GB on 64-bit)
+# ── Upload size caps ──────────────────────────────────────────────────
+# See docs/config/storage-fine-tuning.md for sizing guidance.
+
+# Whole-file size ceiling. Applies to BOTH direct PUTs (per-request body)
+# and chunked uploads (declared `total_size` at session creation — checked
+# upfront so oversized requests never accumulate chunks on disk).
+# Default: 10 GB on 64-bit, 1 GB on 32-bit.
 #OXICLOUD_MAX_UPLOAD_SIZE=10737418240
 
-# Directory for upload spool temp files. Uploads are streamed to a temp file
-# before deduplication. By default this uses the OS temp dir ($TMPDIR / /tmp),
-# which in many containers is tmpfs (RAM) — writing a large upload there fills
-# page-cache that counts against the cgroup memory limit and can OOMKill the
-# process. Point this at a real-disk path (same filesystem as the storage
-# backend is ideal) to keep the upload footprint off RAM. Leave unset to use
-# the OS default.
+# Per-request cap for non-chunked PUT bodies (`POST /api/files/upload`,
+# `PUT /webdav/...`, `PUT /remote.php/dav/files/...`). Set below
+# MAX_UPLOAD_SIZE so files larger than this are pushed onto the chunked
+# protocol (resumable on failure, bounded per-request by CHUNK_MAX_BYTES).
+# Default: 1 GiB.
+#OXICLOUD_DIRECT_PUT_MAX_BYTES=1073741824
+
+# Per-chunk cap for a single chunked-upload PUT (PATCH /api/uploads/{id}
+# or PUT /dav/uploads/.../chunk). NC desktop and the OxiCloud frontend
+# split large files into chunks of this size or smaller, so this knob
+# tightly bounds the worst-case per-request memory/disk footprint
+# independently of the whole-file cap. Default: 100 MB.
+#OXICLOUD_CHUNK_MAX_BYTES=104857600
+
+# ── Upload spool directories ─────────────────────────────────────────
+# Where in-flight uploads land BEFORE being promoted into final blob
+# storage. Same-filesystem placement (with `.blobs/`) makes the
+# promotion an atomic rename(2); NVMe placement speeds up intake.
+# See docs/config/storage-fine-tuning.md for layout examples.
+
+# Directory for non-chunked PUT spool tempfiles. Default: OS temp dir
+# ($TMPDIR / /tmp), often tmpfs (RAM) in containers — writing a large
+# upload there fills page-cache that counts against the cgroup memory
+# limit and can OOMKill the process. Point this at a real-disk path
+# (same FS as the storage backend is ideal).
 #OXICLOUD_UPLOAD_TMPDIR=/var/lib/oxicloud/tmp
 
+# Root directory for chunked-upload sessions (REST + NextCloud chunked
+# share this root). Default: {STORAGE_PATH}/.uploads. Pointing this at
+# NVMe accelerates the chunk-write + assembly loop; pointing it at the
+# same FS as `.blobs/` makes blob promotion atomic.
+#OXICLOUD_CHUNK_DIR=/var/lib/oxicloud/.uploads
+
 # How often (seconds) the background sweep reconciles each user's cached
 # storage usage with the real sum of their files (default: 600 = 10 min).
 # GET /api/auth/me serves the cached value instead of recomputing per request;